CVE-2026-85046

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected

Google · Chrome

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

48.88% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2026-09-04

Published

2026-09-03

Updated

2026-09-21

Proof-of-concept exploits (7)

• HORKimhab/CVE-2026-850461★ · 2026-09-04
• adriyansyah-mf/cve-2026-85046-poc6★ · 2026-09-05
• atiilla/CVE-2026-850468★ · 2026-09-08
• SneakyNachos/CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm1★ · 2026-09-08
• SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter5★ · 2026-09-11
• SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-…5★ · 2026-09-15
• jamezx32/CVE-2026-85046

Security advisories

• https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_018827973…
• Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_C…
• https://news.ycombinator.com/item?id=49570669
• https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion
• v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67

References

• CVE Record
• NVD entry

Related

• CVE-2022-29464
• CVE-2023-23752
• CVE-2026-110447
• CVE-2026-41940
• CVE-2026-20841
• CVE-2026-21852